ASIC RG 260 — ASIC Regulatory Guide – RG 260 Communicating findings from audit files to directors, audit committees or senior managers

Page 1 REGULATORY GUIDE 260 Communicating findings from audit files to directors, audit committees or senior managers October 2025 About this guide This guide is for directors, audit committees and senior managers of companies, responsible entities, superannuation trustees or disclosing entities, and for audit firms. It explains which financial reporting and audit quality findings identified from our reviews of audit files we would communicate to the relevant directors, audit committees or senior managers. It also provides guidance on the process we will follow and the timing of our communication. Page 2 REGULATORY GUIDE 260: Communicating findings from audit files to directors, audit committees or senior managers © Australian Securities and Investments Commission October 2025 Page 2 About ASIC regulatory documents In administering legislation ASIC issues the following types of regulatory documents. Consultation papers: seek feedback from stakeholders on matters ASIC is considering, such as proposed relief or proposed regulatory guidance. Regulatory guides: give guidance to regulated entities by:  explaining when and how ASIC will exercise specific powers under legislation (primarily the Corporations Act)  explaining how ASIC interprets the law  describing the principles underlying ASIC’s approach  giving practical guidance (e.g. describing the steps of a process such as applying for a licence or giving practical examples of how regulated entities may decide to meet their obligations). Information sheets: provide concise guidance on a specific process or compliance issue or an overview of detailed guidance. Reports: describe ASIC compliance or relief activity or the results of a research project. Document history This guide was issued in October 2025 and is based on legislation and regulations as at the date of issue. Previous versions:  Superseded Regulatory Guide 260, issued June 2017, reissued 2022 Disclaimer This guide does not constitute legal advice. We encourage you to seek your own professional advice to find out how the Corporations Act and other applicable laws apply to you, as it is your responsibility to determine your obligations. Examples in this guide are purely for illustration; they are not exhaustive and are not intended to impose or imply particular rules or requirements. Page 3 REGULATORY GUIDE 260: Communicating findings from audit files to directors, audit committees or senior managers © Australian Securities and Investments Commission October 2025 Page 3 Contents A Overview ........................................................................................... 4 ASIC’s ability to communicate financial reporting and audit quality findings............................................................................................... 4 Advising directors of our audit surveillances ..................................... 5 Communicating financial reporting and audit quality findings ........... 5 ASIC’s process and timing of communication ................................... 6 B Advising directors of audit surveillances ..................................... 7 Rationale ............................................................................................ 7 Timing of communication ................................................................... 7 C Communicating financial reporting and audit quality findings .. 8 Rationale for communicating findings ................................................ 8 Focuses of our audit surveillances and financial reporting surveillances ...................................................................................... 9 Criteria for communicating financial reporting findings ...................... 9 Criteria for communicating audit quality findings ............................... 9 Other concerns we may communicate ............................................ 11 D Process and timing of communication ....................................... 12 Confidentiality .................................................................................. 12 Financial reporting matters .............................................................. 12 Audit quality matters ........................................................................ 14 Key terms ............................................................................................... 16 Related information ............................................................................... 18 Page 4 REGULATORY GUIDE 260: Communicating findings from audit files to directors, audit committees or senior managers © Australian Securities and Investments Commission October 2025 Page 4 A Overview Key points The Australian Securities and Investments Commission Act 2001 (ASIC Act) allows ASIC to directly communicate specific financial reporting and audit quality findings (that we identify in our reviews of audit files) to the relevant directors, audit committees or senior managers of companies, responsible entities, superannuation trustees, or disclosing entities. This guide is intended to provide guidance on: • our rationale for advising the relevant directors of our audit surveillances and the timing of this communication (see Section B); • our rationale and criteria for communicating financial reporting and audit quality findings from our reviews of audit files to the relevant directors, audit committees or senior managers (see Section C); and • the process we will follow (including for meeting our procedural fairness obligations) and the timing of communicating financial reporting and audit quality findings to the relevant directors, audit committees or senior managers (see Section D). ASIC’s ability to communicate financial reporting and audit quality findings RG 260.1 The ASIC Chairperson can communicate financial reporting and audit quality findings from our reviews of audit files directly to the relevant directors, audit committees or senior managers of a company, responsible entity, superannuation trustee or disclosing entity to assist the entity to properly manage its affairs: see s127(2D) of the ASIC Act. RG 260.2 We will communicate findings from our review of the audit file based on the criteria set out in Section C of this guide. We will afford procedural fairness by giving the auditor an opportunity to make submissions, and provide the auditor concerned with at least seven days’ notice before communicating the findings. RG 260.3 The information disclosed to the entity must be about: (a) how the audit of the relevant company, registered scheme, registrable superannuation entity (RSE) or disclosing entity was conducted by an auditor; or (b) those entities’ compliance with: (i) the requirements in Ch 2M of the Corporations Act 2001 (Corporations Act) to prepare financial statements and reports; or Page 5 REGULATORY GUIDE 260: Communicating findings from audit files to directors, audit committees or senior managers © Australian Securities and Investments Commission October 2025 Page 5 (ii) the continuous disclosure requirements of s674, 674A, 675 and 675A of the Corporations Act. RG 260.4 We will rely on s127(2D) of the ASIC Act to communicate findings from our reviews of audit files to the relevant directors, audit committees or senior managers. RG 260.5 We do not always need to rely on s127(2D) of the ASIC Act to communicate information. This is the case if no confidential information is disclosed. RG 260.6 Information Sheet 196 Audit quality—The role of directors and audit committees (INFO 196) encourages audit committees to ask audit firms about the results of our reviews of audit files for an entity and how the firm has addressed the matters raised. RG 260.7 Our ability to report financial reporting findings, and to report audit quality findings to the relevant directors, audit committees or senior managers, under s127(2D) of the ASIC Act is separate from our ability to issue an audit deficiency report under s50C of the ASIC Act. Note: This guide does not apply to the publication of audit deficiency reports under s50C of the ASIC Act. RG 260.8 ‘Senior managers’ is a term used in s127(2D) of the ASIC Act and would include a chief executive officer and a chief financial officer. Advising directors of our audit surveillances RG 260.9 Section B of this guide provides guidance on our approach to communicating to the relevant directors that we will be reviewing audit files relating to their audited entity as part of our audit surveillances. RG 260.10 We will notify the relevant directors of our planned file review five business days after we have informed the audit firm. We encourage the relevant directors to seek information directly from their auditors about any issues or concerns that may be identified in our review. Communicating financial reporting and audit quality findings RG 260.11 In Section C of this guide, we give guidance on which financial reporting findings, and which audit quality findings from our reviews of audit files, we would disclose to the relevant directors, audit committees or senior managers concerned. Page 6 REGULATORY GUIDE 260: Communicating findings from audit files to directors, audit committees or senior managers © Australian Securities and Investments Commission October 2025 Page 6 RG 260.12 We explain our criteria for communicating findings where we have concerns that the financial statements may be materially misstated based on information in the audit file. RG 260.13 We will generally communicate, including where the auditor has not, in our view, obtained reasonable assurance that the financial report is free of material misstatement. RG 260.14 We will generally communicate findings to the directors of an audited company or disclosing entity, the directors of the responsible entity of an audited registered scheme and the directors of the trustee for an audited RSE (collectively ‘the relevant directors’) rather than to the audit committee or senior managers. This is because the relevant directors have statutory responsibilities in relation to the financial report. Companies may have an audit committee (being a board subcommittee comprising directors) that oversees the financial reporting process and deals with the auditor. The relevant directors may ask the audit committee to deal with any audit findings communicated in the first instance. ASIC’s process and timing of communication RG 260.15 We will communicate to the relevant directors, audit committees or senior managers about financial reporting and audit quality findings from the review of an audit file. Section D of this guide explains the process we will follow (including for meeting our procedural fairness obligations) and the timing of communication. Page 7 REGULATORY GUIDE 260: Communicating findings from audit files to directors, audit committees or senior managers © Australian Securities and Investments Commission October 2025 Page 7 B Advising directors of audit surveillances Key points This section explains the rationale for, and timing of, our communication to directors that we will be reviewing audit files relating to the entity as part of our audit surveillances. Rationale RG 260.16 We will notify the relevant directors of entities that we intend to review the audit files relating to that entity. At the conclusion of our review, we will either communicate matters as outlined in Section C or inform the relevant directors that we had no matters to communicate. RG 260.17 Timely communication to the relevant directors that ASIC will be reviewing audit files relating to their entities will enable the relevant directors to seek information directly from their auditors about any issues and concerns from our review as they arise. RG 260.18 ASIC may select audit files for review either randomly or on a risk basis. However, the selection of an audit file for review should not be taken to suggest that the financial report or the work of the auditor is inadequate. Timing of communication RG 260.19 We generally inform audit firms of our planned audit surveillances at least 10 business days before we start our reviews. We will also inform the relevant directors of our planned review five business days after we have informed the audit firm. Page 8 REGULATORY GUIDE 260: Communicating findings from audit files to directors, audit committees or senior managers © Australian Securities and Investments Commission October 2025 Page 8 C Communicating financial reporting and audit quality findings Key points This section provides guidance on our rationale and criteria for communicating financial reporting and audit quality findings from our review of audit files to the relevant directors, audit committees or senior managers of companies, responsible entities, superannuation trustees or disclosing entities. Rationale for communicating findings RG 260.20 Directors have primary responsibility for the quality of financial reporting. The quality of financial reports is supported by the quality of the independent audit. Directors cannot simply rely on the work of the auditor and should ensure that an entity has adequate systems and processes to ensure quality financial reports. Directors should also support and promote high-quality independent audits in the interests of investor and market confidence. RG 260.21 Our rationale for communicating both financial reporting and audit quality findings that we identify in audit files is to help directors and audit committees: (a) take action to address deficiencies in an entity’s financial report; (b) improve systems and processes supporting financial reporting; and (c) engage with the auditor about steps the auditor will take to improve audit quality. Note: See INFO 196. RG 260.22 This rationale reflects the requirement in s127(2D)(c) of the ASIC Act that the relevant information disclosed should assist the entity to properly manage its affairs. RG 260.23 If an auditor does not address deficiencies in their audit, the directors may seek the resignation or removal of the auditor. Page 9 REGULATORY GUIDE 260: Communicating findings from audit files to directors, audit committees or senior managers © Australian Securities and Investments Commission October 2025 Page 9 Focuses of our audit surveillances and financial reporting surveillances RG 260.24 Our audit surveillances and financial reporting surveillances: (a) predominantly focus on recognition and measurement issues involving potential material misstatements of profits and net assets—arising from accounting policy choices and estimates (e.g. asset values); (b) exclude matters that, in our view, are within a range of reasonable judgement; and (c) exclude matters that, in our view, concern genuine issues about the interpretation of the accounting and auditing standards, which may be matters for the relevant international and local standards-setting body or interpretation committees. Criteria for communicating financial reporting findings Material misstatements in financial reports RG 260.25 We will communicate to the relevant directors, audit committees or senior managers when we have identified concerns in our review of an audit file that an entity’s financial report is materially misstated. We do this to support quality financial reporting and confident and informed investors and markets. We will consider referring to specific information from the entity’s records contained in the audit files that may assist in addressing the matter more efficiently and on a timelier basis. RG 260.26 Section D explains the process we will follow before communicating to the relevant directors, audit committees or senior managers any specific financial reporting findings from our reviews of audit files. Criteria for communicating audit quality findings Findings to be communicated RG 260.27 We will generally communicate audit quality findings and other matters identified from our reviews of audit files in our audit surveillances to the relevant directors concerned where: (a) we have formed the view that an auditor has not obtained reasonable assurance that an entity’s financial report is free of material misstatement; Page 10 REGULATORY GUIDE 260: Communicating findings from audit files to directors, audit committees or senior managers © Australian Securities and Investments Commission October 2025 Page 10 (b) we have concerns that the auditor of an entity does not meet the independence requirements of the Corporations Act (including professional requirements), has not addressed the independence matter and/or has not adequately reported the matter in an auditor’s independence declaration; or (c) we consider any other matter should be drawn to the attention of the relevant directors, audit committee or senior managers of the: (i) audited company or disclosing entity; (ii) responsible entity of the audited registered scheme; or (iii) trustee of the audited RSE. RG 260.28 Our criteria in RG 260.27 are based on the objective of an audit, as set out in the auditing standards having the force of law under the Corporations Act— that is, to obtain reasonable assurance that a financial report is free of material misstatement. The auditing standards provide a framework to support the application of our criteria and are the basis we use for measuring audit quality. This basis for measuring audit quality is also used by the International Forum of Independent Audit Regulators and most other international audit oversight regulators. RG 260.29 Information on ASIC’s findings will enable the relevant directors to prepare high-quality and timely financial information and ask the auditor about the steps they are taking to: (a) address any issues and concerns; (b) improve audit quality; and (c) support investor and market confidence in the quality of financial reports. RG 260.30 Communicating audit independence matters may assist the relevant directors and audit committees to consider the independence of the auditor, how the independence matter will be resolved and, if not resolved, whether the auditor should be replaced. Note: See also INFO 196. RG 260.31 We may not communicate audit quality findings to the relevant directors when those findings relate to audit work performed by a firm that is no longer the auditor of the entity. There is no ongoing relationship between the directors and the former auditor, and the findings may not be relevant to improving the quality of audits of the entity’s future financial reports. Section 127(2D) of the ASIC Act only authorises disclosure of information if that information would assist the entity to properly manage its affairs. Page 11 REGULATORY GUIDE 260: Communicating findings from audit files to directors, audit committees or senior managers © Australian Securities and Investments Commission October 2025 Page 11 Potential enforcement action RG 260.32 While we may not disclose to relevant directors that we intend to take enforcement action against an entity’s auditor, we will communicate our negative findings to those relevant directors. Other concerns we may communicate RG 260.33 We may disclose information from audit files to the relevant directors, audit committees or senior managers when we have other concerns. For example, when: (a) the entity does not produce, under notice, information that we have seen on the audit files; or (b) information available to the auditor and to the directors is inconsistent in relation to a matter. RG 260.34 We will undertake an appropriate process (including for meeting our procedural fairness obligations) before disclosing any information that is provided to us by the auditor: see Section D. RG 260.35 We will consider and decide whether other domestic and international regulators, such as the Australian Prudential Regulation Authority (APRA) or the Australian Taxation Office, should be advised of findings from our reviews of audit files. Page 12 REGULATORY GUIDE 260: Communicating findings from audit files to directors, audit committees or senior managers © Australian Securities and Investments Commission October 2025 Page 12 D Process and timing of communication Key points This section explains our process for, and timing of, our communication to the relevant directors, audit committees or senior managers of financial reporting and/or audit quality findings that we identify in our reviews of audit files. Confidentiality RG 260.36 We must take reasonable measures to prevent unauthorised use and disclosure of information we receive in confidence in connection with our statutory functions: see s127(1) of the ASIC Act. Certain uses and disclosures are taken to be authorised: see s127(2)–(6) of the ASIC Act. Regulatory Guide 103 Confidentiality and release of information (RG 103) deals generally with disclosures by ASIC under s127 of the ASIC Act and how we carry out our procedural fairness obligations for such disclosures. This guide focuses on our disclosures under s127(2D) of the ASIC Act and should be read in conjunction with RG 103. Financial reporting matters RG 260.37 In addition to audit surveillances, we also carry out financial reporting surveillances. Sometimes we identify preliminary concerns through our financial reporting surveillance program that the financial report of an entity might be materially misstated. If we do so, we will seek any information or explanations directly from the relevant entity. We will generally provide a copy of our initial inquiry letter to the entity’s auditor. If the letter to the entity contains confidential information, we will instead advise the auditor that such a letter has been sent to the entity. RG 260.38 If we have also reviewed the audit file, we may consider it necessary to include confidential information from the audit file in our letter to the entity. We will rely on s127(2D) of the ASIC Act to do so. RG 260.39 When we have concerns from our review of the audit files that an entity’s financial report could be materially misstated, we will generally disclose these findings directly to the relevant directors so that appropriate actions can be taken immediately: see RG 260.25–RG 260.26. Page 13 REGULATORY GUIDE 260: Communicating findings from audit files to directors, audit committees or senior managers © Australian Securities and Investments Commission October 2025 Page 13 RG 260.40 While we will generally communicate directly with the relevant directors, there may be instances where we communicate with the audit committee or senior managers. For example, we may communicate in the first instance with the directors but subsequently communicate further detailed information to the audit committee or a senior manager to assist them in addressing a concern with the financial report. RG 260.41 When we communicate information only to a senior manager of an audited company or disclosing entity, a senior manager of the responsible entity of an audited registered scheme or a senior manager of the trustee of an RSE, we must provide a copy of the disclosure to the entity’s relevant directors and the audit committee for the company, disclosing entity, responsible entity or superannuation trustee as soon as possible: see s127(2G) of the ASIC Act. RG 260.42 When we consider that a matter should be communicated to an entity’s relevant directors, we will rely on s127(2D) of the ASIC Act to communicate directly with those directors. In these cases, we will give the auditor reasonable opportunity to make submissions about proposed communications with the relevant directors. If we are proposing to disclose information about how the audit was conducted, we will provide the auditor with at least seven days’ notice: see s127(2F) of the ASIC Act. If the auditor provides submissions, we will consider them when deciding whether to communicate the information to the relevant directors. RG 260.43 In our communication to the relevant directors, we will generally not refer to any confidential information in the audit work papers prepared by the auditor. However, we may include this information if it relates to matters covered under RG 260.27–RG 260.33 or would otherwise assist the entity to properly manage its affairs. RG 260.44 We will generally only refer to information on the audit file that has been provided by the entity to the auditor (e.g. impairment testing model and related assumptions) or information that the auditor has communicated to the audited entity or its relevant directors (e.g. board audit committee report or management letters). RG 260.45 While some matters may be noted in the auditor’s report to members, and as part of the auditor’s communications to the relevant directors, this does not necessarily mean that such matters have been dealt with adequately. RG 260.46 If, in our view, there are significant and genuine disagreements about the interpretation of accounting standards, we may consult with the relevant international and local standards-setting bodies or interpretation committees rather than disclose a matter to the relevant directors. Page 14 REGULATORY GUIDE 260: Communicating findings from audit files to directors, audit committees or senior managers © Australian Securities and Investments Commission October 2025 Page 14 Audit quality matters RG 260.47 We review audit files regularly throughout the year in our audit surveillances. We communicate findings from each review to the firm in writing as we conduct our individual audit file reviews. RG 260.48 At the end of every 12-month period to 30 June, we also issue public report(s) that covers all findings from reviews substantially completed in that period. RG 260.49 We will communicate matters that we have identified from reviews of audit files about the quality of an audit to relevant directors, audit committees or senior managers as each matter is finalised with the firm. RG 260.50 We also conduct auditor surveillance activities on a case-by-case basis when, for example, we have intelligence about potential audit deficiencies or auditor misconduct. RG 260.51 Delaying communications with the relevant directors may not be in the interests of audit quality, particularly where a past audit should be remediated or a subsequent audit may be affected. RG 260.52 We will endeavour to give the auditor appropriate opportunities to respond to our findings. RG 260.53 Where we propose to disclose findings about how an audit was conducted, we will provide the auditor with at least seven days’ notice: see s127(2F) of the ASIC Act. The auditor may make a submission during this period about whether or not they believe we should make the proposed disclosure. If the auditor provides a submission, we will consider it when deciding whether to disclose the information. Note: See also INFO 196. RG 260.54 If the auditor does not respond to our notice of proposed communication, we may communicate information to the entity’s relevant directors without considering the auditor’s views about the communication. However, we will generally first try to find out whether there are reasons for a delayed response and consider those reasons. RG 260.55 The fact that an auditor disagrees with our findings is not a reason for us not to communicate a matter to the entity’s relevant directors. RG 260.56 When we decide to communicate matters to entities after considering any concerns raised by the auditor, we will include the auditor’s response on the matter or a summary of that response in our communication to the entity. Page 15 REGULATORY GUIDE 260: Communicating findings from audit files to directors, audit committees or senior managers © Australian Securities and Investments Commission October 2025 Page 15 RG 260.57 If, in our view, there are significant and genuine differing views on the interpretation of auditing standards, we may consult with the relevant international and local standards-setting bodies and interpretation committees rather than communicate a matter to the relevant directors. RG 260.58 It is not intended that the relevant directors, audit committees or senior managers seek to meet with ASIC to discuss the matters we communicate. Page 16 REGULATORY GUIDE 260: Communicating findings from audit files to directors, audit committees or senior managers © Australian Securities and Investments Commission October 2025 Page 16 Key terms Term Meaning in this document accounting standards Standards issued by the Australian Accounting Standards Board under s334 of the Corporations Act ASIC Australian Securities and Investments Commission ASIC Act Australian Securities and Investments Commission Act 2001 audit firm A firm that consents to be appointed, or is appointed, as auditor of a company, registered scheme or RSE, and a firm that audits a disclosing entity auditing standards Standards issued by the Auditing and Assurance Standards Board under s336 of the Corporations Act audit surveillance ASIC’s proactive and reactive reviews of audit files based on intelligence and possible concerns about audit quality, through targeted or random selection to assess compliance with auditing requirements of the Corporations Act Corporations Act Corporations Act 2001, including regulations made for the purposes of the Act excluded approved deposit fund Has the meaning given in s10(1) of the Superannuation Industry (Supervision) Act 1993 (SIS Act) exempt public sector superannuation scheme Has the meaning given in s10(1) of the SIS Act financial report A full-year or half-year financial report required under Pt 2M.3 of the Corporations Act financial reporting surveillance ASIC’s program of proactive reviews of financial reports of selected listed companies, RSEs and other public interest entities for compliance with financial reporting requirements of the Corporations Act INFO 196 (for example) An ASIC information sheet (in this example numbered 196) relevant directors Directors of:  an audited company or disclosing entity;  a responsible entity of an audited registered scheme; or  a trustee for an audited RSE (as applicable) RG 103 (for example) An ASIC regulatory guide (in this example numbered 103) Page 17 REGULATORY GUIDE 260: Communicating findings from audit files to directors, audit committees or senior managers © Australian Securities and Investments Commission October 2025 Page 17 Term Meaning in this document RSE A registrable superannuation entity as defined in s10(1) of the SIS Act (other than exempt public sector superannuation schemes, excluded approved deposit funds and small APRA funds) s127(2F) (for example) A section of the ASIC Act (in this example numbered 127(2F)), unless otherwise specified senior manager Used in s127(2D) of the ASIC Act and would include a Chief Executive Officer and Chief Financial Officer SIS Act Superannuation Industry (Supervision) Act 1993 small APRA fund Has the meaning given in s1017BB(6) of the Corporations Act Page 18 REGULATORY GUIDE 260: Communicating findings from audit files to directors, audit committees or senior managers © Australian Securities and Investments Commission October 2025 Page 18 Related information Headnotes audit findings, audit firms, auditor, audits, communicating audit findings, financial reporting, material misstatement, process, surveillance, timing Regulatory guides RG 103 Confidentiality and release of information Information sheets INFO 196 Audit quality—The role of directors and audit committees Consultation papers CP 352 Communicating audit findings to directors, audit committees or senior managers Reports REP 730 Response to submissions on CP 352 Communicating audit findings to directors, audit committees or senior managers Legislation ASIC Act, s50C, 127, 127(1), 127(2)–(6), 127(2D), 127(2D)(c), 127(2F), 127(2G) Corporations Act, Ch 2M, s674, 674A, 675, 675A, 1017BB(6) SIS Act, s10(1)